You can delegate a group permission to read all user information. (Source: Windows 2000)